Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service (GNOME gnome-remote-desktop)

CVE-2026-18358
HIGH 7.5

En bref

Source
NVD
EPSS
EPSS 0.66 % · centile 52 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
redhat
Statut NVD
Awaiting Analysis

Rechercher sur…

Description

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version.

Faiblesses (CWE)

  • CWE-400 — Consommation de ressources non maîtrisée (déni de service)

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hredhat
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD · secalert@redhat.com (Secondary)

Références européennes

Produits affectés

ProduitVersions
GNOME · gnome-remote-desktop
Red Hat · Red Hat Enterprise Linux 10unaffected 0:49.3-4.el10_2 < *
Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Supportunaffected 0:47.3-3.el10_0.1 < *
Red Hat · Red Hat Enterprise Linux 8
Red Hat · Red Hat Enterprise Linux 9

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD